On Thu, Apr 22, 2021, Paolo Bonzini wrote: > On 22/04/21 04:21, Sean Christopherson wrote: > > Check CR3 for an invalid GPA even if the vCPU isn't in long mode. For > > bigger emulation flows, notably RSM, the vCPU mode may not be accurate > > if CR0/CR4 are loaded after CR3. For MOV CR3 and similar flows, the > > caller is responsible for truncating the value. > > > > Note, SMRAM.CR3 is read-only, so this is mostly a theoretical bug since > > KVM will not have stored an illegal CR3 into SMRAM during SMI emulation. > > Well, the guest could have changed it... That's what I tried to address with "SMRAM.CR3 is read-only". Both Intel and AMD state that modifying read-only fields will result in unpredictable behavior, i.e. KVM going into the weeds would be within spec. IIRC, there's no real danger to the host, it'll "just" fail VM-Enter. SDM: Some register images are read-only, and must not be modified (modifying these registers will result in unpredictable behavior) APM: Software should not modify offsets specified as read-only or reserved, otherwise unpredictable results can occur.
